Method and system for monitoring signal integrity in a distributed controls system

• US 8,118,122 B2
• Filed: 10/07/2008
• Issued: 02/21/2012
• Est. Priority Date: 10/25/2007
• Status: Active Grant

• Current Assignee: Bayerische Motoren Werke AG, Daimler AG (Mercedes-Benz Group AG), Chrysler Group LLC (Stellantis NV)
• Original Assignee: Bayerische Motoren Werke AG, GM Global Technology Operations LLC (General Motors Company), Daimler AG (Mercedes-Benz Group AG), Chrysler LLC (Stellantis NV)
• Inventors: Buur, Hanne, Cawthorne, William R., Wozniak, Leonard G.
• Primary Examiner(s): Ilan, Ruth
• Assistant Examiner(s): Frisby, Keith
• Application Number:
  US12/246,641
• Publication Number:
  US 20090107745A1
• Time in Patent Office: 1,232 Days
• Field of Search: 701/33, 701/36, 701/54, 180/65.265, 903/930
• US Class Current: 180/65.265
• CPC Class Codes: B60K 1/02 comprising more than one electric motor
• CPC Class Codes: B60K 6/365 with the gears having orbital motion
• CPC Class Codes: B60K 6/445 Differential gearing distribution type
• CPC Class Codes: B60K 6/547 the transmission being a stepped gearing
• CPC Class Codes: B60L 2240/423 Torque
• CPC Class Codes: B60W 10/06 including control of combustion engines
• CPC Class Codes: B60W 10/08 including control of electric propulsion units, e.g. motors or generators
• CPC Class Codes: B60W 10/115 with planetary gears
• CPC Class Codes: B60W 20/00 Control systems specially adapted for hybrid vehicles hybrid vehicle design, B60K6/00; electric vehicles B60L
• CPC Class Codes: B60W 20/10 Controlling the power contribution of each of the prime movers to meet required power demand
• CPC Class Codes: B60W 2050/0006 Digital architecture hierarchy
• CPC Class Codes: B60W 2540/10 Accelerator pedal position
• CPC Class Codes: B60W 2540/12 Brake pedal position
• CPC Class Codes: B60W 2710/083 Torque
• CPC Class Codes: B60W 50/02 Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
• CPC Class Codes: B60W 50/0205 Diagnosing or detecting failures; Failure detection models
• CPC Class Codes: B60W 50/04 Monitoring the functioning of the control system
• CPC Class Codes: F16H 2037/0873 with switching, e.g. to change ranges
• CPC Class Codes: Y02T 10/62 Hybrid vehicles
• CPC Class Codes: Y02T 10/64 Electric machine technologies in electromobility
• CPC Class Codes: Y02T 90/16 : Information or communication technologies improving the operation of electric vehicles
• CPC Class Codes: Y10S 903/93 : Conjoint control of different elements

Abstract

A method to monitor integrity of a signal in a distributed control system for a powertrain system includes communications link transmitting signals between control modules. Integrity of each of the control modules is monitored. The signal is generated and verified in an originating control module and transmitted to a receiving control module whereat it is subsequently verified.

Claims

1. Method to monitor integrity of a signal generated and communicated in a control system for a powertrain system including an engine, a transmission and a torque generating machine connected to an energy storage device, the transmission operative to transfer power between the engine and the torque generating machine and an output member, the method comprising:

establishing a distributed control module system comprising a first control module operatively connected to the engine, a second control module operatively connected to the torque generating machine, a third control module operatively connected to the transmission device, and a hybrid control module operative to command operation of the first, second, and third control modules;

establishing a communications link to transmit the signal between any two of the first control module, the second control module, the third control module and the hybrid control module and a user interface;

monitoring integrity of each of the first, second, third, and hybrid control modules;

generating the signal in an originating control module comprising one of the first, second, third and hybrid control modules;

verifying integrity of the signal within the originating control module;

transmitting the signal via the communications link to a receiving control module comprising one of the first, second, third and hybrid control modules that is not the originating control module; and

verifying integrity of the transmitted signal within the receiving control module.

2. The method of claim 1, further comprising verifying integrity of the signal within the originating control module by redundantly storing the signal at first and second memory locations in a memory device of the originating control module and comparing the redundantly stored signals at the first and second memory locations immediately prior to transmitting the redundantly stored signals.

3. The method of claim 2, further comprising transmitting the redundantly stored signals via the communications link.

4. The method of claim 3, further comprising receiving and storing the transmitted redundantly stored signals in first and second memory locations in the receiving control module.

5. The method of claim 2, comprising detecting corruption of the signal and executing remedial action when a difference between the redundantly stored signals is greater than a threshold.

6. The method of claim 4, further comprising verifying integrity of the transmitted signal within the receiving control module by comparing the transmitted redundantly stored signals stored in first and second memory locations within the receiving control module.

7. The method of claim 6, comprising detecting corruption of the signal when a difference between the transmitted redundantly stored signals is greater than a threshold.

8. The method of claim 7, further comprising executing remedial action upon detecting corruption of the signal.

9. The method of claim 1, wherein the signal comprises one of an operator command signal, a sensor input signal, and an actuator control signal.

10. The method of claim 1, wherein generating the signal in the originating control module further comprises monitoring integrity of algorithmic code stored in memory and executed in the originating control module.

11. The method of claim 1, wherein monitoring integrity of the control modules comprises monitoring hardware integrity of the control modules and associated memory devices and monitoring integrity of algorithms and memory devices.

12. The method of claim 11, further comprising monitoring integrity of algorithms and memory devices by verifying integrity of algorithmic code, calibrations and variable data stored in the memory devices of the control modules.

13. Method to monitor signal integrity in a control system for a powertrain system including an engine, an electro-mechanical transmission and a plurality of torque generating machines connected to an energy storage device, the electro-mechanical transmission operative to transfer power between the engine and the torque generating machines and an output member, the method comprising:

establishing a distributed control module system comprising a first control module operatively connected to the engine, a plurality of second control modules corresponding to and operatively connected to the plurality of torque generating machines, a third control module operatively connected to the electro-mechanical transmission, and a hybrid control module operative to generate commands to control operation of the powertrain system;

establishing a communications link between the control modules;

monitoring hardware integrity of each of the control modules;

monitoring integrity of memory devices of each of the control modules;

monitoring integrity of algorithms and memory devices of the control modules;

monitoring communications integrity; and

executing remedial action upon detection of a fault.

14. The method of claim 13, wherein monitoring communications integrity comprises:

generating the signal in an originating control module comprising one of the control modules;

verifying integrity of the signal within the originating control module;

transmitting the signal via the communications link;

receiving the signal at a receiving control module comprising one of the control modules that is not the originating control module; and

verifying integrity of the transmitted signal within the receiving control module.

15. The method of claim 14, further comprising:

storing the signal at first and second memory locations in a memory device of the originating control module;

verifying integrity of the signals stored at the first and second memory locations within the originating control module;

establishing a serial communications link to transmit the verified signals;

transmitting the verified signals from the originating control module through the serial communications link;

receiving the transmitted verified signals at the receiving control module;

storing the transmitted verified signals at first and second memory locations within the receiving control module; and

verifying integrity of the stored transmitted signals within the receiving control module.

16. The method of claim 15, wherein the signal comprises an operator command signal, a sensor input signal, and an actuator control signal.

17. The method of claim 15, further comprising:

generating a primary and a redundant signal;

storing the primary signal at the first memory location and storing the redundant signal at the second memory location;

executing diagnostics on the primary signal and the redundant signal;

executing a rationality check on the primary signal and the redundant signal; and

executing a fault maturation algorithm to detect signal corruption based upon the rationality check on the primary signal and the redundant signal.